Client credentials grant workflow

Authenticate a client application using a client credentials workflow. The client credentials grant workflow is used by back-end services or system integrations to access ServiceNow® APIs without user involvement.

Avant de commencer

Role required: oauth_admin, mi_admin, admin

Pourquoi et quand exécuter cette tâche

This workflow describes how a client application (back-end service or system integration) authenticates directly with ServiceNow using its client credentials without user interaction. The application requests an access token using its client ID and client secret, which ServiceNow validates before issuing the token. The client then uses this token to access ServiceNow APIs. ServiceNow validates each request before returning the appropriate response.

Figure 1. Client credentials grant workflow

Procédure

1. The client application makes a token request to the ServiceNow end point with the following parameters:

   Method: POST
   Endpoint: https://<servicenow_base_url>/oauth_token.do

   Tableau 1. Token Request Parameters

   Parameter	Required	Description
   grant_type	Yes	OAuth 2.0 grant type. Example: client_credentials
   client_id	Yes	Unique identifier for the client application. Example:YOUR_CLIENT_ID
   client_secret	Yes	Secret associated with the client ID. Example:YOUR_CLIENT_SECRET
   scope	Optional	Requested permissions for the access token. Example: incident_read incident_write

2. ServiceNow validates the credentials and returns the access token.
3. Make an API request with the access token.

   Include the access token in the Authorization header of each API request.

   Method: POST
   Endpoint: https://<servicenow_base_url>/api/now/incident  
   Authorization: Bearer YOUR_ACCESS_TOKEN

4. ServiceNow validates the token and returns the appropriate API response.
   Remarque :

   Use the client credentials grant workflow only with trusted, server-side applications. Maintain the client_secret securely. Ensure that you don’t use the client_secret in client-side environments such as browsers or mobile apps.